[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: [Bug-gnuzilla] GNU LibreJS won't be removed from GNU IceCat
From: |
Ivan Zaigralin |
Subject: |
Re: [Bug-gnuzilla] GNU LibreJS won't be removed from GNU IceCat |
Date: |
Tue, 27 Feb 2018 10:33 -0800 |
User-agent: |
KMail/4.14.10 (Linux/4.4.115-gnu; KDE/4.14.32; x86_64; ; ) |
On 02/22/2018 02:56 PM, David Hedlund wrote:
> On 2018-02-22 09:22, Ivan Zaigralin wrote:
>> GPL-licensed code is not necessarily free. An obfuscated source is
>> unmaintainable regardless of the license, so two freedoms are taken
>> away: the freedom to study, and the freedom to run modified versions.
>> LibreJS is unable to detect obfuscated code.
>
> Thank you. This is a bug, can you please file a bug report to
> https://savannah.gnu.org/bugs/?group=librejs ?
If anyone wants to submit this issue/bug via the formal channels, god-speed,
but I am hardly the right person to do that. The issue being: one of the
stated design goals of LibreJS is to block non-free JS while allowing free JS,
but it doesn't look like this goal is attainable even in principle without a
human or human-grade AI vetting every incoming byte. And even with such
fantastic vetting in place, there is still the intractable problem of users
not being able to *afford* to change the behavior of *disposable* software,
which effectively takes away a core freedom, regardless of how the disposable
code is licensed. (A detailed explanation is cited at the end of this post.)
So on one hand, it does not feel right to me to create a ticket which will
basically say that the very concept of LibreJS is misguided, the stated goals
are unattainable, the users are misled, and the energy would be better spent
on *unscripting* the web. Not only this would be borderline trolling, but I am
also taking notice of other people's personal opinions on the matter. RMS, in
particular, has been reported to believe in the usefulness of LibreJS. Perhaps
RMS considers the marginal profit stemming from filtering out *some* nonfree
code as beneficial enough to offset the downsides: the filter is not perfect,
and users continue to cozy up to a platform which will never be free. Perhaps
RMS thinks that any amount of attention drawn to this problem is better than
nothing, even if it's due to a technical non-solution. And perhaps he is
right, I really cannot build a strong argument against such notions.
On the other hand, I personally have had a single interaction with Savannah
collective so far, and it was not a very pleasant one, although if I had to
point a finger to one person most to blame, it would be me :) I basically
popped a vein and raised hell when they told me my project will not be hosted
because it's not "generally useful", and I managed to convince them to admit
the subjective component of the initial review on their web page. It took a
lot of time and fighting, and the final result looks like "...but is
ultimately at the discretion of Savannah hackers."
https://savannah.gnu.org/maintenance/HowToGetYourProjectApprovedQuickly/
I'd rather see a clear description of this rejection policy, which is in fact
based on a *subjective* perception of quality and usefulness by a single
examiner, but just having them to officially *confirm* this policy in a
mailing list took KiBs of heated exchange. So I am afraid that if I come back
with another highly contentious issue like the very fate of LibreJS, no matter
how good my argument is, it will produce more pointless anger and friction.
I have to say, this thread really made me think about the JS trap some more,
and I really feel that with the help of bill's sharp questions we are making
some progress here. I realized that in order to make the web useful without
having to run nonfree software, we must *unscript* it. Fixing individual
pages/domains will not solve the problem posed by the disposable software; the
way we interact with the web must change, and this can only be effected via a
standardization of a protocol. And the other thing I realized, there is a
clear path forward, and it has to do with web masters. One of the most
important parts of LibreJS project is its appeal to web masters, who are being
asked to free the JS code in order to disabuse the users. We need to go after
the same web masters, and ask them to do more, if not something else entirely.
If these web masters already believe that a free web is a worthy goal, we
should be able to convince them to act now by making sure their web pages are
fully functional without JS. We should also be able to convince them to make
the non-JS version the default, and create a long-term plan for ditching JS
completely. And if they also want to annotate the legacy JS code so that its
license can be checked by a simple AI, that's fine too, as long as they keep
their eyes on the prize.
On Tuesday, February 27, 2018 00:19:29 bill-auger wrote:
> On 02/26/2018 10:10 AM, David Hedlund wrote:
> > Issues can be reported to https://savannah.gnu.org/bugs/?group=librejs
> > as well since there are not dedicated "issue" link for LibreJS.
>
> im not sure what is the difference between "issues" and "bugs" but
> libreJS has a separate tracker for general user support questions if
> that is what you meant:
>
> https://savannah.gnu.org/support/?func=additem&group=librejs
>
> and libreJS has multiple mailings lists also:
>
> https://savannah.gnu.org/mail/?group=librejs
My previous rant on the issue is cited below for easy reference.
> this is confusing - what exactly is a
> "drive-by-download" and how are they inherently "non-free no matter what
> license is attached to them"?
>
> also, how could LibreJS "incorrectly mark an obfuscated piece of
> GPL-licensed code as free" - GPL-licensed code IS free
GPL-licensed code is not necessarily free. An obfuscated source is
unmaintainable regardless of the license, so two freedoms are taken away: the
freedom to study, and the freedom to run modified versions. LibreJS is unable
to detect obfuscated code.
What I mean by drive-by-downloading, here we get philosophical. How free is
the code which is only meant to be executed once? No one audits > 99% of this
code, and it's all in constant flux. I would even argue, there's no hope it
can ever be audited. There are already (I am sure) websites that generate
brand-new code for every visit, making this assertion literal. How do you
audit all that code? With an automated tool? An algorithm can't even solve a
halting problem, let alone audit itself out of a paper bag.
Now put yourself in the shoes of an average web user. Average here is the key
word. Their freedoms to understand and modify the JavaScript code have all but
completely eroded. In a traditional software distribution market they can hire
experts to explain and fix the software for them. This is utterly unaffordable
if every click generates new software.
And now back to drive-by-downloading, which is important because it is perhaps
the source of the problem. All of this is happening, as we all know very well,
because average users are willing to run software from any source, as long as
it doesn't make their computer explode right away. They don't even understand
the basic difference between downloading data versus downloading and executing
an arbitrary algorithm. When a blog, or a news site, or a government website
won't load because you didn't let it run an arbitrary algorithm on your
computer, that's crazy, just crazy. And the norm. These users who leave all
JavaScript on, they already buried 2 of their freedoms, and the boilerplate
license on the disposable code can't change that. They need to be told to
boycott sites which require JS to function, and to demand legislation which
would require something like HTML+CSS web fronts from commercial and
government entities. It is not at all helpful, in my opinion, to differentiate
between varieties of JavaScript sources, because none of them should be
downloaded in the first place. Most importantly, web masters who want a free
web should stop using JavaScript, and they should be transitioning right now,
and not stop until there's nothing left for LibreJS to mark as free. All
desired JavaScript functionality can be trivially recreated via a combination
of free browser plugins and calls to free and standard libraries. The drive-
by-download culture, on the other hand, will plunge us deeper into the sea of
disposable software.
signature.asc
Description: This is a digitally signed message part.
- Re: [Bug-gnuzilla] GNU LibreJS won't be removed from GNU IceCat, (continued)
- Re: [Bug-gnuzilla] GNU LibreJS won't be removed from GNU IceCat, Julie Marchant, 2018/02/21
- Re: [Bug-gnuzilla] GNU LibreJS won't be removed from GNU IceCat, Ivan Zaigralin, 2018/02/22
- Re: [Bug-gnuzilla] GNU LibreJS won't be removed from GNU IceCat, bill-auger, 2018/02/22
- Re: [Bug-gnuzilla] GNU LibreJS won't be removed from GNU IceCat, Ivan Zaigralin, 2018/02/22
- Re: [Bug-gnuzilla] GNU LibreJS won't be removed from GNU IceCat, bill-auger, 2018/02/22
- Re: [Bug-gnuzilla] GNU LibreJS won't be removed from GNU IceCat, Julie Marchant, 2018/02/22
- Re: [Bug-gnuzilla] GNU LibreJS won't be removed from GNU IceCat, David Hedlund, 2018/02/22
- Re: [Bug-gnuzilla] GNU LibreJS won't be removed from GNU IceCat, bill-auger, 2018/02/22
- Re: [Bug-gnuzilla] GNU LibreJS won't be removed from GNU IceCat, David Hedlund, 2018/02/26
- Re: [Bug-gnuzilla] GNU LibreJS won't be removed from GNU IceCat, bill-auger, 2018/02/27
- Re: [Bug-gnuzilla] GNU LibreJS won't be removed from GNU IceCat,
Ivan Zaigralin <=
- Re: [Bug-gnuzilla] GNU LibreJS won't be removed from GNU IceCat, bill-auger, 2018/02/27
- Re: [Bug-gnuzilla] GNU LibreJS won't be removed from GNU IceCat, bill-auger, 2018/02/27
- Re: [Bug-gnuzilla] GNU LibreJS won't be removed from GNU IceCat, bill-auger, 2018/02/27
- Re: [Bug-gnuzilla] GNU LibreJS won't be removed from GNU IceCat, Ivan Zaigralin, 2018/02/28
- Re: [Bug-gnuzilla] GNU LibreJS won't be removed from GNU IceCat, Narcis Garcia, 2018/02/22
- Re: [Bug-gnuzilla] GNU LibreJS won't be removed from GNU IceCat, Ivan Zaigralin, 2018/02/22
- Re: [Bug-gnuzilla] GNU LibreJS won't be removed from GNU IceCat, Narcis Garcia, 2018/02/22
- Re: [Bug-gnuzilla] GNU LibreJS won't be removed from GNU IceCat, Ivan Zaigralin, 2018/02/22
- Re: [Bug-gnuzilla] GNU LibreJS won't be removed from GNU IceCat, Narcis Garcia, 2018/02/22
- Re: [Bug-gnuzilla] GNU LibreJS won't be removed from GNU IceCat, Loic Duros, 2018/02/22